Opposite of "head" ?

[the_wolverine]

I'm trying to find out what the oldest occurrence of an event was - as in, opposite of head. Is there such a command?

I've tried using " * | reverse | head 1 " which works but is very slow and inefficient.

[the_wolverine]

w00t!!!!!!!!!!!

[Genti]

awesome awesome awesome!!!

[araitz]

tail fail tail fail

[fk319 · Accepted solution]

'tail' is implimented in 4.1.5 http://www.splunk.com/base/Documentation/4.1.5/SearchReference/Tail

[Genti]

| sort _time, that is, no - sign...

[Genti]

i tried that, and then i tried * | sort -_time and this seems to be faster. I am unaware of a command that is the opposite of head...